CVE-2026-84731

highpriority · track · 0OT risk · elevatedEPSS 0.013 · 70 %ileDE

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.28% (70th) EPSS

CVSS 10 · high

Is it mine?

12 products

Check your exposure

Who says so?

1 sources

cert_bund

EPSS · scored 2026-10-28

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.1–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Csecondaryexploitability 10 · impact 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Redsecondary

v4.09.1criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:H/U:Redsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USCWE-302USCWE-306US

affected products (12)

Products and version ranges known to be affected.

Nutanix AOS< 7.3.1.18cert_bundDE
Nutanix AOS< 7.5.2cert_bundDE
Nutanix AOS< 7.6.0.8cert_bundDE
Nutanix Nutanix AOS <7.3.1.18< 7.3.1.18cert_bundDE
Nutanix Nutanix AOS <7.5.2< 7.5.2cert_bundDE
Nutanix Nutanix AOS <7.6.0.8< 7.6.0.8cert_bundDE
Nutanix Nutanix Prism Central <7.3.1.18< 7.3.1.18cert_bundDE
Nutanix Nutanix Prism Central <7.5.2< 7.5.2cert_bundDE
Nutanix Nutanix Prism Central <7.6.0.8< 7.6.0.8cert_bundDE
Nutanix Prism Central< 7.3.1.18cert_bundDE
Nutanix Prism Central< 7.5.2cert_bundDE
Nutanix Prism Central< 7.6.0.8cert_bundDE

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3991Nutanix AOS und Nutanix Prism Central: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2026-10-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Nutanix AOS und Nutanix Prism Central ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Programmcode mit Administratorrechten auszuführen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-10-15modified 2026-10-16

references (3) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan